Lesson 4.6: Stolen sessions: MFA bypass with AiTM phishing and infostealers
After you sign in, the browser keeps a session token so you don't have to sign in again. Steal that token and you are the user, with MFA already done. Adversary-in-the-middle (AiTM) phishing kits do this by relaying the real login page and keeping the token; infostealer malware takes tokens and saved passwords from browsers. Infostealer credentials were behind the 2024 breaches of many Snowflake customer accounts that had no MFA. In the lab you follow an AiTM attack on Lena from Finance: the phishing link, the same session used from two countries, a hidden inbox rule and invoice-fraud emails.
17 min
You will learn to
- Explain session tokens and why MFA doesn't protect them
- Explain AiTM phishing and infostealers
- Find one session used from several addresses
- Find malicious inbox rules
- Respond: revoke, reset, clean up, prevent
Key terms
- Session token
- A cookie or token that proves you already signed in.
- AiTM phishing
- A phishing proxy that relays the real login, including MFA, and keeps the session.
- Infostealer
- Malware that collects saved passwords, cookies and tokens from browsers and sells them.
- BEC
- Business email compromise: fraud using a real or look-alike business mailbox.
- Phishing-resistant MFA
- Authenticators bound to the real site's origin, such as FIDO2 keys and passkeys.
← Reviewing a TLS configuration · All lessons · Reading security advisories: CVE, CVSS and known exploitation →